Certificates Snap-in

The role of digital certificates is growing rapidly on individual computers and networks and across the Internet. Although certificates can be used with little or no user intervention, it can also be important to view and understand certificate contents, and to manage their use. You can accomplish these goals by using the Certificates snap-in.

  • What is the Certificates Snap-in?

  • Certificates Overview

  • Add the Certificates Snap-in to an MMC

  • Manage Certificates

  • Troubleshoot Certificate-related Problems

  • Resources for Certificates


What is the Certificates Snap-in?

The Certificates snap-in is the primary tool for users and administrators to view and manage certificates for a user, computer, or service.

The Certificates snap-in allows the user to request, renew, find, view, move, copy, and delete certificates.

Why use the Certificates snap-in

The Certificates snap-in is a versatile tool for managing certificates for a user, computer, or service. It can be used to find out what certificates are stored on a computer, where they are stored, or the configuration options for those certificates.

In addition, using the Certificates snap-in, the user can launch wizards that simplify the tasks of:

  • Enrolling for new certificates

  • Renewing existing certificates

  • Finding certificates

  • Importing certificates

  • Exporting or backing up certificates

In most cases, users do not have to personally manage their certificates and their certificate stores. That can be accomplished by administrators, by policy settings, and through programs that use certificates.

Administrators are the primary users of the Certificates snap-in and, as such, they are able to perform a wide variety of certificate management tasks in their personal certificate store as well as the certificate stores for any computer or service that they have the right to administer. Users can only manage certificates in their personal store.

For information about certificates and how to use the Certificates snap-in, see the following topics:

  • Certificates Overview

  • Add the Certificates Snap-in to an MMC

  • Manage Certificates

  • Troubleshoot Certificate-related Problems

  • Resources for Certificates


Certificates Overview

A public key certificate, usually just called a certificate, is a digitally-signed statement that binds the value of a public key to the identity of the person, device, or service that holds the corresponding private key. One of the main benefits of certificates is that hosts no longer have to maintain a set of passwords for individual subjects who need to be authenticated as a prerequisite to access. Instead, the host merely establishes trust in a certificate issuer.

Most certificates in common use are based on the X.509v3 certificate standard.

Typically, certificates contain the following information:

  • The subject's public key value.

  • The subject's identifier information, such as the name and e-mail address.

  • The validity period (the length of time that the certificate is considered valid).

  • Issuer identifier information.

  • The digital signature of the issuer, which attests to the validity of the binding between the subject’s public key and the subject’s identifier information.

A certificate is valid only for the period of time specified within it; every certificate contains Valid From and Valid To dates, which set the boundaries of the validity period. Once a certificate's validity period has passed, a new certificate must be requested by the subject of the now-expired certificate.

  • Using Certificates

  • Public and Private Keys

  • Certificate File Formats


Using Certificates

Certificates can be used for:

  • Authentication, which verifies the identity of someone or something.

  • Privacy, which ensures that information is only available to the intended audience.

  • Encryption, which disguises information so that unauthorized readers are unable to decipher it.

  • Digital signatures, which provide nonrepudiation and message integrity.

These security services can be important to the security of your communications. In addition, many Windows applications use certificates, including Microsoft Internet Information Services (IIS), Microsoft Outlook, Microsoft Outlook Express, and Internet Explorer.

Authentication

Authentication is crucial in making communication more secure. Users must be able to prove their identity to those with whom they communicate and must be able to verify the identity of others. Authentication of identity on a network is complex because the communicating parties do not physically meet as they communicate. This can allow an unethical person to intercept messages or to impersonate another person or entity.

Privacy

Whenever sensitive information is transmitted between computing devices on any type of network, users should generally use some sort of encryption to keep their data private.

Encryption

Encryption can be thought of as locking something valuable into a strong box with a key. Conversely, decryption can be compared to opening the box and retrieving the valuable item. On computers, sensitive data in the form of e-mail messages, files on a disk, and files being transmitted across the network can be encrypted using a key. Encrypted data and the key used to encrypt data are both unintelligible.

For more information about encryption and certificates, see Resources for Certificates.

Digital signatures

A digital signature is a way to ensure the integrity and origin of data. A digital signature provides strong evidence that the data has not been altered since it was signed and it confirms the identity of the person or entity who signed the data. This enables the important security features of integrity and nonrepudiation, which are essential for secure electronic commerce transactions.

Digital signatures are typically used when data is distributed in plaintext, or unencrypted form. In these cases, while the sensitivity of the message itself might not warrant encryption, there could be a compelling reason to ensure that the data is in its original form and has not been sent by an impostor because, in a distributed computing environment, plaintext can conceivably be read or altered by anyone on the network with the proper access, whether authorized or not.


Public and Private Keys

In public key encryption, different keys are used to encrypt and decrypt information. The first key is a private key (a key that is known only to its owner), while the second key — called the public key — can be made known and available to other entities on the network.

The two keys are different but complementary in function. For example, a user’s public key can be published in a certificate in a directory so that it is accessible to other people in the organization. The sender of a message can retrieve the user’s certificate from Active Directory, obtain the public key from the certificate, and then encrypt the message by using the recipient's public key. Information that is encrypted with the public key can be decrypted only by using the corresponding private key of the set, which remains with its owner, the recipient of the message.


Certificate File Formats

The type of certificate file formats you use can be based on a combination of security and compatibility concerns. In this version of Windows, you can import and export certificates in the following formats:

  • Personal Information Exchange (PKCS #12)

    The Personal Information Exchange format (PFX, also called PKCS #12) enables the transfer of certificates and their corresponding private keys from one computer to another or from a computer to removable media.

    Because exporting a private key might expose it to unintended parties, the PKCS #12 format is the only format supported in this version of Windows for exporting a certificate and its associated private key.

  • Cryptographic Message Syntax Standard (PKCS #7)

    The PKCS #7 format enables the transfer of a certificate and all the certificates in its certification path from one computer to another, or from a computer to removable media

  • DER Encoded Binary X.509

    DER (Distinguished Encoding Rules) for ASN.1, as defined in ITU-T Recommendation X.509, might be used by certification authorities that are not on computers running Windows Server 2003, so it is supported for interoperability. DER certificate files use the .cer extension.

  • Base64 Encoded X.509

    This is an encoding method developed for use with Secure/Multipurpose Internet Mail Extensions (S/MIME), which is a popular, standard method for transferring binary attachments over the Internet.

    Because all MIME-compliant clients can decode Base64 files, this format might be used by certification authorities that are not on computers running Windows Server 2003, so it is supported for interoperability. Base64 certificate files use the .cer extension.

Additional resources

  • Import a Certificate

  • Export a Certificate

  • Export a Certificate with the Private Key

  • View the Certificates in a PKCS #7 file


Add the Certificates Snap-in to an MMC

You can use the Certificates snap-in to manage certificates for a user, computer, or service account. To switch between managing certificates for your user account, a computer, or a service, you must add separate instances of the Certificates snap-in to the console.

Adding the Certificates Snap-in to an MMC

  • For a user account

  • For a computer account

  • For a service

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To add the Certificates snap-in to an MMC for a user account

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, double-click Certificates, and then:

    • If you are logged on as an administrator, click My user account, and then click Finish.

    • If you are logged on as a user, Certificates automatically loads.

  4. If you have no more snap-ins to add to the console, click OK.

  5. To save this console, on the File menu, click Save.

Additional considerations

  • User certificates can be managed by the user or by an administrator.

Local Administrators is the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To add the Certificates snap-in to an MMC for a computer account

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, double-click Certificates

  4. Select Computer account and then click Next.

  5. Do one of the following:

    • To manage certificates for the local computer, click Local computer, and then click Finish.

    • To manage certificates for a remote computer, click Another computer and type the name of the computer, or click Browse to select the computer name, and then click Finish.

  6. If you have no more snap-ins to add to the console, click OK.

  7. To save this console, on the File menu, click Save.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • To manage certificates for another computer, you can either create another instance of Certificates in the console, or right-click Certificates (Computer Name), and then click Connect to Another Computer.

Local Administrators is the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To add the Certificates snap-in to an MMC for a service

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, double-click Certificates

  4. Select Service account and then click Next.

  5. Do one of the following:

    • To manage certificates for services on your local computer, click Local computer, and then click Next.

    • To manage certificates for service on a remote computer, click Another computer and type the name of the computer, or click Browse to select the computer name, and then click Next.

  6. Select the service for which you are managing certificates.

  7. Click Finish, and then click Close.

  8. If you have no more snap-ins to add to the console, click OK.

  9. To save this console, on the File menu, click Save.

Additional considerations

  • To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

  • To manage certificates for a service on another computer, you can either create another instance of Certificates in the console, or right-click Certificates - Service (Service Name) on Computer Name, and then click Connect to Another Computer.


Manage Certificates

Certificates are typically issued to a particular computer, user, or service, for specific purposes, for specific durations, and often for specific recipients. As a result, at times you might need to obtain additional certificates, renew existing certificates, examine or modify the properties of a certificate, or move certificates. Although many of these tasks can be performed for a single user, computer, or service, other tasks are best performed automatically by an administrator from a server. The following sections describe common certificate management tasks and the procedure to complete them.

  • Obtain a Certificate

  • Renew a Certificate

  • View Certificates

  • Modify the Properties of a Certificate

  • Delete a Certificate

  • Find Certificates

  • Back Up Certificates

  • Move Certificates

  • Automate Certificate Management


Obtain a Certificate

To enroll for a certificate, a certificate request must be made by the user, computer, or service that has access to the private key associated with the public key that will be part of the certificate. Depending upon the public key policies established by your system administrator, users, computers and services can autoenroll for certificates without user intervention.

Users can also obtain certificates by:

  • Initiating autoenrollment from the Certificates snap-in.

  • Requesting certificates by using the Certificate Request Wizard.

  • Requesting a certificate over the Web.

In addition, administrators can request smart card user certificates and smart card certificates for logging on to the system on behalf of other users by using their enrollment agent certificate.

The following topics contain procedures to use for obtaining certificates:

  • Autoenroll for a Certificate from the Certificates Snap-in

  • Request Certificates Using the Certificate Request Wizard

  • Request a Certificate Over the Web

  • Enroll for Certificates on Behalf of Other Clients

Additional reference

  • Manage Certificates


Autoenroll for a Certificate from the Certificates Snap-in

Many organizations will use Group Policy to automatically enroll users, computers, or services for certificates. With automatic enrollment, a user might see a reminder with a prompt to complete the enrollment. However, there might also be times when a user or administrator wants to verify that all pending automatic enrollment requests are processed. The following procedure describes how to complete this task.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To process automatic enrollment for certificates for a local user or computer

  1. Open the Certificate snap-in for a user or computer.

  2. In the console tree, click Certificates - Current User or Certificates (Local Computer).

  3. On the Action menu, point to All Tasks, and then click Automatically Enroll Certificates.

  4. Click Next. Select the certificates that you want to obtain, and then click Enroll. When the enrollment process is complete, click Finish.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC

Additional references

  • Obtain a Certificate


Request Certificates Using the Certificate Request Wizard

When you request certificates from a Windows-based enterprise certification authority (CA), you can use the Certificate Request Wizard located in the Certificates snap-in. This wizard guides you through the following steps:

  • Selecting the CA to which you will submit the request.

  • Selecting the appropriate certificate template to use for the new certificate.

    Certificate templates are predefined configurations that provide common settings for the certificate request. Certificate templates describe the purpose for which the requested certificate is to be used. The list of certificate templates that is available to you is determined by the certificate types that the CA is configured to issue and whether you have been granted the access rights to the certificate template by the system administrator.

  • (Optional) Using Advanced Options in the Certificate Request Wizard to select the cryptographic service provider (CSP) for the key pair associated with the certificate request.

For instructions about opening and using the Certificate Request Wizard, see Request a Certificate.

You can also use the Certificate Request Wizard to request a new certificate from an enterprise CA by using an existing key pair that is already associated with another certificate.

Additional references

  • Request a Certificate

  • Create a Custom Certificate Request

  • Save a Certificate Request in a File

  • Sign Certificate Requests

  • Obtain a Certificate


Request a Certificate

Requesting certificates through the Certificates snap-in is a simple process that involves a few straightforward steps involving the Certificate Enrollment Wizard. You can request any type of certificate that has been preconfigured and made available by an administrator of the certification authority (CA) that will process the certificate request.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To request a certificate

  1. Open the Certificates snap-in for a user or computer.

  2. In the console tree, click Certificates - Current User or Certificates (Local Computer). Select the Personal certificate store.

  3. On the Action menu, point to All Tasks, and then click Request New Certificate to start the Certificate Enrollment Wizard. Click Next.

  4. Select the types of certificates that you want to request.

  5. You can click Details to review additional information about each certificate.

    If a caution symbol appears below the certificate, you might need to provide additional information before requesting that type of certificate. Click the More information is required to enroll for this certificate. Click here to configure message and provide the requested information, such as the location of a valid signing certificate.

  6. To finish, click Enroll.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC

  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone CA, you need to request certificates by means of Web pages. A Windows CA has its Web pages located at http://servername/certsrv, where servername is the name of the server hosting the CA.

  • You can use this procedure to request certificates based on templates where the subject name is generated by Windows only. To request a certificate based on a template configured to obtain the subject name from the subject, you need to request certificates by means of Web pages.

  • If the requested certificate type requires approval before it is issued, you need to retrieve the completed certificate via Web pages. A Windows CA has its Web pages located at http://servername/certsrv, where servername is the name of the server hosting the CA.

  • In order to request a Digital Signature Standard (DSS) certificate from an enterprise CA, you must select the User Signature Only certificate template in the Certificate Request Wizard.

Additional references

  • Request Certificates Using the Certificate Request Wizard

  • Subject Names

  • Certificate Extensions


Subject Names

The holder of the private key associated with a certificate is known as the subject. This can be a user, a program, or virtually any object or service.

Because the subject can vary greatly depending on who or what it is, some flexibility is needed when providing the subject name in the certificate request. Windows can either build the subject name automatically or request it from the subject manually. If it automatically provides the subject name, Windows obtains the information from Active Directory.

You can configure this process to include or exclude information useful in the environment. If configured to manually provide the subject name, the subject supplies that information in the certificate request, for example by using the Web-based enrollment pages.

Subject names in certificates can be presented using the following formats:

  • Common name. The certification authority creates the subject name from the common name (CN) obtained from Active Directory. This should be unique within a domain, but might not be unique within an enterprise.

  • Fully distinguished name (DN). The certification authority creates the subject name from the fully distinguished name obtained from Active Directory. This guarantees that the name is unique within an enterprise.

  • Include e-mail name in subject name. If the e-mail name field is populated in the Active Directory user object, this e-mail name will be included with either the common name or fully distinguished name as part of the subject name.

  • None. A name value is not required for this certificate.

The following alternate subject name options can also be specified:

  • E-mail name. If the e-mail name field is populated in the Active Directory user object, that e-mail name will be used.

  • DNS name. The fully qualified domain name (FQDN) of the subject that requested the certificate. This is most frequently used in computer certificates

  • User principal name (UPN). The user principal name is part of the Active Directory user object and will be used.

  • Service principal name (SPN). The service principal name is part of the Active Directory computer object and will be used.


Certificate Extensions

The Extensions tab allows an administrator to define specific application policies, issuance policies, certificate subject types, and key usage attributes for a certificate template.

Application policies

Application policies are settings that inform a target that the subject holds a certificate that can be used to perform a specific task. They are represented in a certificate by an object identifier that is defined for a given application. This object identifier is included in the issued certificate. When a subject presents its certificate, the certificate can be examined by the target to verify the application policy and determine whether the subject can perform the requested action.

Issuance policies

Issuance policies, also referred to as certificate policies, define the measures that are used to identify the subject of the certificate and thereby define the level of assurance for an issued certificate. For example, your organization might require a face-to-face meeting before the certificate is issued to provide for a higher level of assurance for the issued certificate.

Certificate subject type

The certificate subject type, also referred to as the certificate template information, defines the purpose of a certificate or certificate template.

The certificate subject type extension cannot be edited. If an administrator requires a specific subject type to be applied to a certificate, the administrator should clone from a certificate template that includes the required subject type.

Key usage

A certificate enables the subject to perform a specific task. To help control the usage of a certificate outside its intended purpose, restrictions are automatically placed on certificates. Key usage is a restriction method that determines what a certificate can be used for. It allows the administrator to issue certificates that can only be used for specific tasks or certificates that can be used for a broad range of functions. If no key usage is specified, the certificate can be used for any purpose.

For signatures, key usage can be limited to one or more of the following purposes:

  • Digital signature

  • Signature is a proof of origin (nonrepudiation)

  • Certificate signing

  • CRL signing

For encryption key usage, the following options are available:

  • Key exchange without key encryption

  • Key exchange only with key encryption

Additional reference

  • Request a Certificate


Create a Custom Certificate Request

Administrators usually configure certificate templates in advance so that clients can use them to request or enroll for certificates. However, there might be occasions when none of the preconfigured certificate templates can meet a client's needs.

Custom requests can be used to modify a certificate template to meet unique needs, or to create a new certificate not based on a template. They can also be used to save a certificate request to a file for processing at a different time or on a different computer.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To create a custom certificate request

  1. Open the Certificates snap-in for a user, computer, or service.

  2. In Logical Certificate Stores view mode, double-click Personal, and then click Certificates.

  3. On the Action menu, point to All Tasks, select Advanced Operations, and then click Create custom request to launch the Certificate Enrollment Wizard. Click Next.

  4. On the Custom Request page, click the drop-down list next to Templates, and do one of the following:

    • If you know what kind of certificate you want and want to accept the default configuration options, select the appropriate certificate template.

    • If you need a completely customized certificate, select (No template) CNG key or (No template) Legacy key.

    Note

    CNG keys might not be compatible with all applications.

  5. Each certificate template includes a standard set of extensions that can indicate additional subject identification information, or it can indicate key usage information, which specifies the tasks (such as signature or encryption) for which a key can be used. If you want to use only the custom extensions that you specify, select the Suppress default extensions check box.

  6. Select the file format you want to use for your certificate request:

    • PKCS #10 is a widely used format for certificate requests

    • CMC can be used to prepare requests that will be submitted to a non-Microsoft certification authority.

  7. Click Next.

  8. Click Details to view details of the certificate request. If you want to customize the request further, click Properties and fill in the desired options. When you are done, click OK to exit Certificate Properties, and then click Next.

  9. Enter a file name and path, and then click Finish.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC

Additional references

  • Request Certificates Using the Certificate Request Wizard


Save a Certificate Request in a File

You can prepare a certificate request for use later, or to retain a copy of the request even if is processed at the same time as it is saved.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To save a certificate request in a PKCS #10 or CMC file

  1. Open Internet Explorer.

  2. In Internet Explorer, open http://servername/certsrv, where servername is the name of the Web server running Windows Server 2003 where the certification authority you want to access is located.

  3. Click Request a certificate, and under Advanced certificate request click Create and submit a request to this CA.

  4. Enter any identifying information requested and any other options you require.

  5. Under Additional Options, select the file format you want to use.

  6. In the Full path name field, type a path and file name.

  7. Click Submit. The file is saved to your computer's desktop.

  8. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • The component that enables Web enrollment in this version of Windows is different from the component that enables Web enrollment in Windows Server 2003 and Windows XP. Windows Server 2003 CA Web enrollment pages must be updated to support both Windows Vista® and earlier clients. For more information, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=63592).

  • You also need to make http://servername a trusted site for Internet Explorer in order to browse for a file on the computer's disk drive. To make http://servername a trusted site, in Internet Explorer, click Tools, point to Internet Options, point to Security, point to Trusted Sites, and then click Sites. Type http://servername, and click OK.

Additional reference

  • Request Certificates Using the Certificate Request Wizard


Sign Certificate Requests

In some cases, certificate requests must be digitally signed by using a valid Enrollment Agent or Signing certificate before a certification authority (CA) will process the request.

Important

Once someone has an Enrollment Agent certificate, that person can enroll for a certificate and generate a smart card on behalf of anyone in the organization. The resulting smart card could then be used to log on to the network and impersonate the real user. Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies over who has one.

One scenario to minimize risk of Enrollment Agent certificate misuse is to have one subordinate CA with very tight administrative controls in your organization that is only used to issue Enrollment Agent certificates. Once the initial Enrollment Agent certificates have been issued, the administrator of the CA can disable the issuance of Enrollment Agent certificates until it is needed again.

By restricting the administrators who can operate the CA service on the subordinate CA, the service can be kept online for the generation and distribution of certificate revocation lists (CRLs) if necessary.

Other CAs in the hierarchy can still issue Enrollment Agent certificates if their policy settings are changed, but you can determine whether inappropriate Enrollment Agent certificates are issued by checking the Issued Certificates log for each CA regularly.

Additional reference

  • Request Certificates Using the Certificate Request Wizard


Request a Certificate Over the Web

By default, every Windows Server 2003 certification authority (CA) has Web pages available for users and administrators. These can be used to perform a variety of tasks related to requesting certificates. These Web pages are located at http://servername/certsrv, where servername is the name of the server that hosts the CA. The certsrv portion of the URL should always be in lowercase letters; otherwise, users may have trouble checking and retrieving pending certificates.

Important

Windows Server 2003 CA Web pages must be updated before users can access these Web pages by using this version of Windows.

Additional references

If you have been granted access permissions, you can perform the tasks described in the following topics:

  • Submit a Basic User Certificate Request over the Web

  • Submit an Advanced Certificate Request over the Web

  • Request a Certificate Using a PKCS #10 or PKCS #7 File

  • Check on a Pending Certificate Request

  • For more information about updating Windows Server 2003 CA Web pages, search the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=46046) for keywords such as "Web enrollment," "Windows Server 2003 CA," or "Xenroll."

  • Obtain a Certificate


Submit a Basic User Certificate Request over the Web

Each CA that is installed on a computer running Windows Server 2003 has Web pages that users can access to submit basic and advanced certificate requests. By default, these pages are located at https://servername/certsrv, where servername is the name of the server hosting the Web pages.

Important

Windows Server 2003 CA Web pages must be updated before users can access these Web pages by using this version of Windows.

When you request certificates from a Windows-based stand-alone CA, you use the Certificate Services Web pages. Web pages can also be used to request certificates from enterprise CAs if you want to set optional request features that are not available in the Certificate Request Wizard, such as marking the keys as exportable, setting key length, choosing the hash algorithm, or saving the request to a file.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To submit a user certificate request over the Web

  1. Open Internet Explorer.

  2. In Internet Explorer, connect to https://servername/certsrv, where servername is the name of the server hosting the Web pages.

  3. Click Request a certificate.

  4. On Request a Certificate, select the type of certificate you want:

    1. If the CA is an enterprise CA, click User Certificate.

    2. If the CA is a standalone CA, select either Web Browser Certificate or E-Mail Protection Certificate.

  5. On the Identifying Information page, enter your identifying information for the certificate request, if needed.

  6. (Optional) Click More Options to specify the cryptographic service provider (CSP) and whether you want to enable strong private key protection. (This means that you will receive a prompt every time that the private key associated with the certificate is used.)

  7. Click Submit.

  8. Do one of the following:

    • If you see the Certificate Pending Web page, see Related Topics below for the procedure to check on a pending certificate.

    • If you see the Certificate Issued Web page, click Install this certificate.

  9. If you are finished using the Web pages, close Internet Explorer.

Additional considerations

  • In order for a user to obtain a certificate using Web enrollment, an administrator must set the appropriate permissions on the certificate templates on which the requested certificate is based.

  • If this is the first time you are accessing the Web server for a CA, you must add the server to the list of Trusted sites in Internet Explorer. Trusted sites can be added by selecting Internet Options on the Tools menu, clicking the Security tab, selecting the Trusted sites zone, and clicking Sites. In addition, the Web server for the CA must be configured to use HTTPS authentication.

Additional references

  • Request a Certificate Over the Web

  • Check on a Pending Certificate Request


Submit an Advanced Certificate Request over the Web

The policy of a certification authority (CA) determines the types of certificates a user can request and the options they can configure. If enabled, you can use the Advanced Certificate Request Web page to set the following options for each certificate requested:

  • Certificate template (from an enterprise CA) or Type of certificate needed (from a stand-alone CA). Indicates what applications the public key in the certificate can be used for, such as client authentication or e-mail.

  • Cryptographic service provider (CSP). A CSP is responsible for creating keys, destroying them, and using them to perform a variety of cryptographic operations. Each CSP provides a different implementation of the CryptoAPI. Some provide stronger cryptographic algorithms, while others use hardware components, such as smart cards

  • Key size. The length, in bits, of the public key on the certificate. In general, longer keys are harder for a hostile user to break than shorter keys.

  • Hash algorithm. A good hash algorithm makes it computationally infeasible to construct two independent inputs that have the same hash. Typical hash algorithms include MD2, MD4, MD5, and SHA-1.

  • Key usage. How the private key can be used. Exchange means that the private key can be used to enable the exchange of sensitive information. Signature means that the private key can be used only to create a digital signature. Both means that the key can be used for both exchange and signature functions.

  • Create new key set or Use existing key set. You can use an existing public and private key pair stored on your computer or create a new public and private key pair for a certificate.

  • Enable strong private key protection . When you enable strong private key protection, you will be prompted for a password every time the private key needs to be used.

  • Mark keys as exportable. When you mark keys as exportable, you can save the public key and the private key to a PKCS #12 file. This is useful if you change computers and want to move the key pair, or if you want to remove the key pair and secure them in another location.

  • Store certificates in the local computer certificate store. Select this option if the computer will need access to the private key associated with the certificate when other users are logged on. Select this option when requesting certificates intended to be issued to computers (such as Web servers) instead of certificates issued to people.

  • Request format. This section can be used to select either PKCS#10 or CMC formats. If you want to submit the request later, you can also select Save request to file.

Important

Windows Server 2003 CA Web pages must be updated before users can access these Web pages by using this version of Windows.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To submit an advanced certificate request over the Web

  1. Open Internet Explorer.

  2. In Internet Explorer, connect to https://servername/certsrv, where servername is the name of the Web server running Windows Server 2003 where the certification authority that you want to access is located.

  3. Click Request a certificate.

  4. Click advanced certificate request.

  5. Click Create and submit a certificate request to this CA.

  6. Fill in any identifying information requested and any other options you require.

  7. Click Submit.

  8. Do one of the following:

    • If you see the Certificate Pending Web page, see Check on a Pending Certificate Request for the procedure to check on a pending certificate.

    • If you see the Certificate Issued Web page, click Install this certificate.

  9. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • In order for a user to obtain a certificate using Web enrollment, an administrator must set the appropriate permissions on the certificate templates on which the requested certificate is based.

  • If this is the first time you are accessing the Web server for a CA, you must add the server to the list of Trusted sites in Internet Explorer. Trusted sites can be added by selecting Internet Options on the Tools menu, clicking the Security tab, selecting the Trusted sites zone, and clicking Sites. In addition, the Web server for the CA must be configured to use HTTPS authentication.

Additional references

  • Check on a Pending Certificate Request

  • Request a Certificate Over the Web


Request a Certificate Using a PKCS #10 or PKCS #7 File

It is not always possible to submit a certificate request online to a certification authority. In these instances, you might still be able to submit a certificate request in the form of a PKCS #7 or PKCS #10 file. In general, you use a PKCS #10 file to submit a request for a new certificate and a PKCS #7 file to submit a request to renew an existing certificate.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To request a certificate uses a PKCS #10 or PKCS #7 file

  1. Open Internet Explorer.

  2. In Internet Explorer, connect to https://servername/certsrv, where servername is the name of the Web server where the web pages you want to access are located.

  3. Click Request a certificate, and then click advanced certificate request.

  4. Click Submit a certificate request using a base-64-encoded CMC or PKCS #10 file or submit a renewal request by using a base-64-encoded PKCS #7 file.

  5. Do one of the following:

    • In Notepad, click File, click Open, select the PKCS #10 or PKCS #7 file, click Edit, click Select all, click Edit, and then click Copy. On the Web page, click in the Saved request scroll box. Click Edit and then click Paste to paste the contents of the certificate request into the scroll box.

    • Click Browse for a file to insert to locate the file you want to use for the certificate request. If you get a warning about the ActiveX control, verify that the source of the control is trustworthy. If it is trustworthy, click Yes to allow it to run, and then click the Browse button. After locating and selecting the file you want to use for the certificate request, click Open. On the Web page, click Read! to paste the contents of the file into the scroll box.

  6. If you are connected to an enterprise CA, choose the certificate template you want to use.

  7. If you have any attributes to add to the certificate request, enter them into Additional Attributes.

  8. Click Submit.

  9. Do one of the following:

    • If you see the Certificate Pending Web page, see Check on a Pending Certificate Request.

    • If you see the Certificate Issued Web page, click Download certificate chain. Choose to save the file to your hard disk, and then import the certificate into your certificate store. For the procedure to import a certificate, see Import a Certificate.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • The component that enables Web enrollment in this version of Windows is different from the component that enables Web enrollment in Windows Server 2003 and Windows XP. Windows Server 2003 CA Web enrollment pages must be updated to support both this version of Windows and earlier clients. For more information, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=63591).

  • If this is the first time you are accessing the Web server for a CA, you must add the server to the list of Trusted sites in Internet Explorer. Trusted sites can be added by selecting Internet Options on the Tools menu, clicking the Security tab, selecting the Trusted sites zone, and clicking Sites. In addition, the Web server for the CA must be configured to use HTTPS authentication.

  • If you submit the request and immediately get a message asking you if you want to submit the request even though it does not contain a BEGIN or END tag, click OK.

Additional references

  • Check on a Pending Certificate Request

  • Import a Certificate

  • Export a Certificate

  • Save a Certificate Request in a File

  • Request a Certificate Over the Web


Check on a Pending Certificate Request

When you submit a certificate request to a Windows-based enterprise CA, it is immediately processed and will either immediately fail or be granted, unless the certificate template has been configured to require approval by a certificate manager.

When you submit a certificate request to a Windows-based stand-alone CA, it will either be immediately processed or, by default, it will be considered pending until the administrator of the CA approves or rejects the request. In the case of a pending request, the certificate requester will have to use the Certificate Services Web pages to check the status of pending certificates.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To check on a pending certificate request

  1. Open Internet Explorer.

  2. In Internet Explorer, open https://servername/certsrv, where servername is the name of the Web server running Windows Server 2003 where the certification authority (CA) you want to access is located.

  3. Click View the status of a pending certificate request.

  4. If there are no pending certificate requests, you will see a message to that effect. Otherwise, select the certificate request you want to check, and then click Next.

  5. Check the pending certificate requests:

    • Still pending. You must wait for the administrator of the CA to issue the certificate. To remove the certificate request, click Remove.

    • Issued. To install the certificate, click Install this certificate.

    • Denied. Contact the administrator of the CA for further information.

  6. If you are finished using the Certificate Services Web pages, close Internet Explorer.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

If this is the first time you are accessing the Web server for a CA, you must add the server to the list of Trusted sites in Internet Explorer. Trusted sites can be added by selecting Internet Options on the Tools menu, clicking the Security tab, selecting the Trusted sites zone, and clicking Sites. In addition, the Web server for the CA must be configured to use HTTPS authentication.

Additional references

  • Request a Certificate Over the Web


Enroll for Certificates on Behalf of Other Clients

It is not always possible for users to enroll for a certificate on their own behalf. This can be the case for a user smart card certificate. By default, only domain administrators are granted permission to request a certificate on behalf of another user. However, a user other than a domain administrator can be granted permission to become an enrollment agent. A user becomes an enrollment agent by enrolling for an Enrollment Agent certificate.

Important

Once someone has an Enrollment Agent certificate, that person can enroll for a certificate and generate a smart card on behalf of anyone in the organization. The resulting smart card could then be used to log on to the network and impersonate the real user. Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies over who has one.

Membership in the Users group and an Enrollment Agent certificate are the minimum requirements to complete this procedure. Review the details in "Additional considerations" in this topic.

To enroll for a certificate on behalf of other users

  1. Open the Certificates snap-in for a user.

  2. Confirm that you are in Logical Stores View.

  3. In the console tree, expand the Personal store, and then click Certificates.

  4. On the Action menu, point to All Tasks, select Advanced Operations, and then click Enroll on behalf of to open the Certificate Enrollment Wizard. Click Next.

  5. Browse to the Enrollment Agent certificate that you will use to sign the certificate request that you are processing. Click Next.

  6. Select the type of certificate that you want to enroll for. When you are ready to request a certificate, click Enroll.

  7. After the Certificate Renewal Wizard has successfully finished, click Close.

Additional considerations

  • User certificates can be managed by a user or by an administrator. To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC

Additional references

  • Obtain a Certificate

  • Registration Authorities


Registration Authorities

A registration authority (RA) is a computer that is configured for an administrator to request and retrieve issued certificates on behalf of other users.

An RA does not have to be installed on the same computer as the certification authority for which it processes certificate requests.


Renew a Certificate

Every certificate has a validity period. After the end of the validity period, the certificate is no longer considered an acceptable or usable credential. The Certificates snap-in enables you to renew a certificate issued from a Windows enterprise certification authority (CA) before or after the end of its validity period by using the Certificate Renewal Wizard.

Renewing certificates

You can either renew the certificate with the same key set you used before, or you can renew a certificate with a new key set. This decision can be based on a number of factors, including the life of the certificate, the length of the existing or future key, the value of the data protected by the key pair, and the likelihood or unlikelihood that a private key has been obtained by a hostile user.

Before you renew a certificate, you need to know:

  • The issuing certification authority.

  • (Optional) If you want a new public key and private key pair for the certificate, the cryptographic service provider (CSP) that should be used to generate the key pair.

Windows provides an expiration notification to let you know that specific user or computer certificates have expired or are about to expire. In most cases, autoenrollment will automatically renew these certificates the next time you are connected to the network and log onto the computer.

The following topics contain procedures to use for renewing certificates:

  • Renew a Certificate with a New Key

  • Renew a Certificate with the Same Key

In addition, you can renew certificates issued from both Windows enterprise CAs and Windows stand-alone CAs with the Certificate Services Web pages by pasting in the contents of a PKCS #7 file. For more information, see the following topic:

  • Request a Certificate Using a PKCS #10 or PKCS #7 File

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can be managed only by an administrator or a user who has been given the appropriate permissions.


Renew a Certificate with the Same Key

Renewing a certificate with the same key allows you maximum compatibility with past uses of the accompanying key pair, but does nothing to enhance the security of the certificate and key pair.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To renew a certificate with the same key

  1. Open the Certificates snap-in for a user, computer, or service.

  2. In the console tree, click Certificates - Current User, select Personal, and click Certificates.

  3. In the details pane, click the certificate you are renewing.

  4. On the Action menu, point to All Tasks, select Advanced Operations, and then click Renew this certificate with the same key to start the Certificate Renewal Wizard.

  5. If more than one certificate is listed in the Request Certificates window, select the certificate that you want to renew. Do one of the following:

    • Use the default values to renew the certificate.

    • Click Details and then Properties to provide your own certificate renewal settings. You need to know the certification authority issuing the certificate.

  6. Click Enroll. After the Certificate Renewal Wizard has successfully finished, click Finish.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC

  • Once renewed, the old certificate will be archived.

  • You can use this procedure to request certificates from an enterprise certification authority only. To request certificates from a stand-alone certification authority, you need to request certificates by means of Web pages. A Windows certification authority has its Web pages located at http://servername/certsrv, where servername is the name of the server that hosts the certification authority.


Renew a Certificate with a New Key

Renewing a certificate with a new key allows you to continue using an existing certificate and its associated data, while enhancing the strength of the key associated with the certificate. This can be desirable if using a new certificate would cause disruption and the existing certificate has not been compromised.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To renew a certificate with a new key

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Confirm that you are in Logical Stores View.

  3. In the console tree, expand the Personal store, and then click Certificates.

  4. In the details pane, click the certificate you are renewing.

  5. On the Action menu, point to All Tasks, and then click Renew Certificate with New Key to open the Certificate Renewal Wizard.

  6. In the Certificate Renewal Wizard, do one of the following:

    • Use the default values to renew the certificate.

    • (For advanced users only) Click Details and then Properties to provide your own certificate renewal settings. You need to know the cryptographic service provider (CSP) and the certification authority (CA) issuing the certificate.

      You need to select the key length (measured in bits) of the public key associated with the certificate

      You can also choose to enable strong private key protection. Enabling strong private key protection ensures that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.

  7. When you are ready to request a certificate, click Enroll. After the Certificate Renewal Wizard has successfully finished, click Close.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC

  • Once renewed, the old certificate and key pair will be archived.

  • You can use this procedure to request certificates from an enterprise CA only. To request certificates from a stand-alone CA, you need to request certificates by means of Web pages. A Windows CA has its Web pages located at http://servername/Certsrv, where servername is the name of the server that hosts the CA.


View Certificates

Certificates can be issued and used for many purposes. It can be useful to examine certificate stores, certificate information and properties, and information about archived and revoked certificates.

  • Display Certificate Stores

  • View Certificate Information

  • View Certificate Properties

  • View the Certificates in a PKCS #7 file

  • Display Archived Certificates

  • View Certificate Revocation List Details


Display Certificate Stores

Using the Certificates snap-in, you can display the certificate store for a user, a computer, or a service according to the purpose for which the certificates were issued or by using their logical storage categories. When you display certificates according to their storage categories, you can also choose to display the physical stores, showing the certificate storage hierarchy. (This is recommended for advanced users only.)

If you have the user rights to do so, you can import or export certificates from any of the folders in the certificate store. Additionally, if the private key associated with a certificate is marked as available for export, you can export both into a PKCS #12 file.

Windows can also publish certificates to Active Directory. Publishing a certificate in Active Directory enables all users or computers with adequate permissions to retrieve the certificate as needed.

Certificate stores

Certificates can be displayed by purpose or by logical stores, as shown in the following table. Displaying certificates by logical stores is the Certificates default.

Note

The list of certificate purpose stores does not include all the possible purpose stores.

Display by Folder name Contents

Logical Store

Personal

Certificates associated with private keys to which you have access. These are the certificates that have been issued to you or to the computer or service for which you are managing certificates.

Note to administrators: Computers in a Windows Server 2003 Active Directory domain can have certificates automatically placed in this store through the use of Group Policy-based autoenrollment. For more information, see "Automatic certificate request settings."

Trusted Root Certification Authorities

Implicitly trusted certification authorities. Includes all of the certificates in the Third-Party Root Certification Authorities store plus root certificates from your organization and Microsoft.

If you are an administrator and want to add third-party certification authority certificates to this store for all computers in a Windows Server 2003 Active Directory domain, you can use Group Policy to distribute trusted root certificates to your organization. For more information, see "Trusted root certification authority policy."

Enterprise Trust

A container for certificate trust lists. A certificate trust list provides a mechanism for trusting self-signed root certificates from other organizations and limiting the purposes for which these certificates are trusted. For more information about Enterprise trust see "Enterprise trust policy."

Intermediate Certification Authorities

Certificates issued to subordinate certification authorities. If you are an administrator, you can use Group Policy to distribute certificates to the Intermediate Certification Authorities store.

Trusted People

Certificates issued to people or end entities that are explicitly trusted. Most often these are self-signed certificates or certificates explicitly trusted in an application such as Microsoft Outlook. If you are a domain administrator, you can use Group Policy to distribute certificates to the Trusted People store.

Other People

Certificates issued to people or end entities that are implicitly trusted. These certificates must be part of a trusted certification hierarchy. Most often these are cached certificates for services like Encrypting File System, where certificates are used for creating authorization for decrypting an encrypted file.

Trusted Publishers

Certificates from certification authorities that are trusted by Software Restriction policies. If you are a domain administrator, you can use Group Policy to distribute certificates to the Trusted Publishers store.

Disallowed Certificates

These are certificates that you have explicitly decided not to trust using either Software Restriction policy or by clicking "Do not trust this certificate" when the decision is presented to you in mail or a Web browser. If you are a domain administrator, you can use Group Policy to distribute certificates to the Disallowed Certificates store.

Third-Party Root Certification Authorities

Trusted root certificates from certification authorities other than Microsoft and your organization. You cannot use Group Policy to distribute certificates to the Third-Party Root Certification Authorities store.

Certificate Enrollment Requests

Pending or rejected certificate requests.

Active Directory User Object

Certificates associated with your user object and published in Active Directory.

Purpose

Server Authentication

Certificates that server programs use to authenticate themselves to clients.

Client Authentication

Certificates that client programs use to authenticate themselves to servers.

Code Signing

Certificates associated with key pairs used to sign active content.

Secure E-mail

Certificates associated with key pairs used to sign e-mail messages.

Encrypting File System

Certificates associated with key pairs that encrypt and decrypt the symmetric key used for encrypting and decrypting data by Encrypting File System (EFS).

File Recovery

Certificates associated with key pairs that encrypt and decrypt the symmetric key used for recovering encrypted data by Encrypting File System (EFS).

When you look at the contents of a certificate store in Logical Store mode, you will occasionally see what appear to be two copies of the same certificate in the store. This occurs because the same certificate is stored in separate physical stores under a logical store. When the contents of the physical certificate stores are combined into one logical store view, both instances of the same certificate are displayed.

You can verify this by setting View Options to show the Physical certificate stores and then noting that the certificate is stored in separate physical stores under the same logical store. You can verify that it is the same certificate by comparing the serial numbers.

Additional references

  • Display Certificate Stores in Logical Store Mode

  • Display Certificate Stores in Purpose Store Mode

  • Display Archived Certificates

  • Move Certificates


Learn More About Certificate Stores

Windows stores a certificate locally on the computer or device that requested it or, in the case of a user, on the computer or device that the user used to request it. The storage location is called the certificate store. A certificate store often has numerous certificates, possibly issued from a number of different certification authorities.

You can view certificates based on their purpose, such as Client Authentication, Code Signing, and so on; or based on logical roles, such as Personal, Trusted Publishers, Trusted Root Certification Authorities, and so on.

In addition, you can also use certificate store options to view archived certificates and the certificate stores storage structure.

Additional references

  • Display Certificate Stores in Logical Store Mode

  • Display Certificate Stores in Purpose Store Mode


Display Certificate Stores in Logical Store Mode

Logical certificate stores group certificates together in logical, functional categories for users, computers, and services. They provide pointers to the physical certificate stores. The use of logical certificate stores eliminates the need to store duplicates of common public key objects, such as trusted root certificates, CTLs, and CRLs for users, computers, and services.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To display certificate stores in Logical Store mode

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Open Certificates - Current.

  3. Right-click Certificates - Current, click View, and then click Options.

  4. Under Organize view mode by, click Logical certificate stores, and then click OK. The title Logical Store Name will appear at the top of the right-hand column when you click the top node the Certificates snap-in, enabling you to select the logical store whose certificates you want to view.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • When you look at the contents of a certificate store in Logical Store mode, you will occasionally see what appear to be two copies of the same certificate in the store. This occurs because the same certificate is stored in separate physical stores under a logical store. When the contents of the physical certificates stores are combined into one logical store view, both instances of the same certificate are displayed.

    You can verify this by setting the view option to show the physical certificate stores and then noting that the certificate is stored in separate physical stores under the same logical store. You can verify that it is the same certificate by comparing the serial numbers.


Display Certificate Stores in Purpose Store Mode

Certificate Purpose mode allows you to view and inspect certificates based on what they are intended to be used for, such as client authentication or key recovery, rather than on their logical roles.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To display certificate stores in Certificate purpose view mode

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Open Certificates - Current User or Certificates (Local Computer).

  3. Right-click Certificates - Current, click View, and then click Options.

  4. Under View mode, click Certificate purpose, and then click OK. The title Intended Purposes will appear at the top of the right-hand column, allowing you to select the type of certificates you need to inspect more closely.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.


View Certificate Information

Users should think about which certificates to trust and accept, and which to distrust or ignore. When you double-click a certificate you can obtain a great deal of information about its characteristics and intended uses. This information is contained on three tabs: General, Details, and Certification Path.

General Tab

Details Tab

Certification Path Tab


General Tab

You can view information about the fields, extensions, and properties that define an issued certificate by double-clicking any certificate displayed in the certificate store.

Selecting the General tab provides a general overview of the certificate, including the following information:

  • Supported uses of the certificate. Summary information, such as the applications, signing, encryption, or authentication, for which the certificate can be used. This section also explains if a certificate has expired or is not valid.

  • Entity to which the certificate was issued. The name of recipient of the certificate. Recipients can include end users, computers, or entities such as CAs.

  • The issuer of the certificate. The name of the CA that issued the certificate.

  • Validity period of the certificate. This includes the date the certificate becomes valid to the date that the certificate expires.

  • Issuer statement. Clicking the Issuer Statement button opens a separate window with a text containing additional information about the certificate or a URL where additional information can be obtained.


Details Tab

Using the Certificates snap-in, you can view information about the fields, extensions, and properties that define an issued certificate by double-clicking any certificate displayed in the certificate store. The following fields, extensions, and properties can be viewed using Certificates:

The Details dialog box provides the following information about the certificate:

  • Version: The X.509 version number.

  • Serial number: The unique serial number that the issuing certification authority assigns to the certificate. The serial number is unique for all certificates issued by a given certification authority.

  • Signature algorithm: The hash algorithm that the certification authority uses to digitally sign the certificate.

  • Issuer: Information regarding the certification authority that issued the certificate.

  • Valid from: The beginning date for the period in which the certificate is valid.

  • Valid to: The final date for the period in which the certificate is valid.

  • Subject: The name of the individual, computer, device, or certification authority to whom the certificate is issued. If the issuing certification authority exists on a domain member server in your enterprise, this will be a distinguished name within the enterprise. Otherwise, this may be a full name and e-mail name or some other personal identifier.

  • Public key: The public key type and length associated with the certificate.

  • Thumbprint algorithm: The hash algorithm that generates a digest of data (or thumbprint) for digital signatures.

  • Thumbprint: The digest (or thumbprint) of the certificate data.

  • Friendly name: (Optional) A friendly, or common, name for the name in the Subject field.

  • Enhanced key usage: (Optional) The purposes for which this certificate can be used.

There are additional possible X.509v3 extensions that could be in a certificate. If they are present, they will be displayed as well.

Additional references

Certificate Validity Periods

Hash Algorithms

Cryptographic Service Providers

Guidelines for Using Alternate Signature Formats


Certificate Validity Periods

The Certificates snap-in enables you to renew a certificate issued from a Windows enterprise certification authority before or after the end of its validity period by using the Certificate Renewal Wizard.

About certificate validity

Every certificate has a validity period. After the end of the validity period, the certificate is no longer considered an acceptable or usable credential.

You can renew the certificate either with the same key set that you used before, or with a new key set.

Before you renew a certificate, you must know the issuing certification authority.

  • Optionally, if you want a new public key and private key pair for the certificate, you must know the cryptographic service provider (CSP) that should be used to generate the key pair.

For more information, see Renew a Certificate with a New Key and Renew a Certificate with the Same Key.

In addition, you can renew certificates issued from both enterprise certification authorities and stand-alone certification authorities with the Certificate Services Web pages by pasting in the contents of a PKCS #7 file. For more information, see Request a Certificate Using a PKCS #10 or PKCS #7 File.


Hash Algorithms

A hash algorithm is an algorithm that produces a hash value of some piece of data, such as a message or session key. With a good hash algorithm, changes in the input data can alter every bit in the resulting hash value. For this reason, hashes are useful in detecting any modification in a data object, such as a message. Furthermore, a good hash algorithm makes it computationally infeasible to construct two independent inputs that have the same hash. Typical hash algorithms include MD5, SHA-1, and SHA-256.


Cryptographic Service Providers

A cryptographic service provider (CSP) is the program that performs authentication, encoding, and encryption services that Windows-based applications access through the Microsoft Cryptography application programming interface (CryptoAPI). Each CSP provides a different implementation of the CryptoAPI. Some provide stronger cryptographic algorithms, while others use hardware components, such as smart cards.

What is a cryptographic service provider?

When you generate a request for a new certificate, the information in that request is first passed from the requesting program to CryptoAPI. CryptoAPI passes the proper data to a CSP that is installed on your computer or on a device that is accessible to your computer. If the CSP is software-based, it generates a public key and a private key, often referred to as a key pair, on your computer. If the CSP is hardware-based, such as a smart card CSP, it instructs a piece of hardware to generate the key pair.

After the keys are generated, a software-based CSP encrypts and then secures the private key. A smart card CSP stores the private key on a smart card. The smart card then controls access to the key.

The public key is sent to the certification authority, along with the certificate-requester information. After the CA verifies the certificate request according to its policies, it uses its own private key to create a digital signature in the certificate and then issue it to the requester. The CA presents the certificate to the certificate requester along with the option to install it in the appropriate certificate store on the computer or hardware device.

For more information, see Request a Certificate.

For more information, see Guidelines for Using Alternate Signature Formats.


Guidelines for Using Alternate Signature Formats

Selecting the option Use alternate signature formats implements the PKCS #1 v2.1 signature format for certificates.

For certificates based on RSA algorithms, PKCS #1 v2.1 specifies separate object identifiers for the hash algorithm and for the asymmetric algorithm. (In PKCS #1 v.1.5, only one object identifier is used to identify both the hash and asymmetric algorithms.) In addition, if you select the alternate signature format for certificates based on RSA algorithms, an enhanced cryptographic formula is used to create the signature.

For certificates not based on RSA algorithms, selecting Use alternate signature formats specifies separate object identifiers for the hash algorithm and for the asymmetric algorithm.

Before using the alternate signature format in your certificates, you need to verify that your clients' CAs and clients can accept these signature formats. Earlier versions of Windows cannot validate certificates that use the alternate signature format. In addition, certificates issued by using the alternate signature format might not be compatible with non-Microsoft certification authorities or non-Microsoft clients.

For more information about PKCS #1 v.2.1, see PKCS #1: RSA Cryptography Standard (http://go.microsoft.com/fwlink/?LinkId=66621) on the RSA Laboratories Web site.

For more information about the RSA implementation of the signature format, see Raising the Standard for RSA Signatures: RSA-PSS (http://go.microsoft.com/fwlink/?LinkId=66622) on the RSA Laboratories Web site.


Certification Path Tab

Using the Certification path tab, you can view the path from the selected certificate to the certification authorities that issue the certificate.

Before it trusts a certificate, this version of Windows must verify that the certificate comes from a trusted source. This verification process is called path validation.

Path validation involves processing public key certificates and their issuer certificates in a hierarchical fashion until the certificate chain terminates at a trusted, self-signed certificate. Typically, this is a root CA certificate. If there is a problem with one of the certificates in the path, or if it cannot find a certificate, the certification path is considered a non-trusted certification path.

A typical certification path includes a root certificate and one or more intermediate certificates. By clicking View Certificate, you can also learn more about the certificates for each certification authority in the path.


View Certificate Properties

The Certificate Properties dialog box provides information and property selections for certificates and cross-certificates. It contains two tabs, General and Cross-Certificates, and can be accessed by right-clicking a certificate and selecting Properties.

  • Properties General Tab

  • Properties Cross-Certificates Tab


Properties General Tab

The General tab can be used to provide a Friendly name and Description that can be used to differentiate between two certificates that are nearly identical, such as two unique signing certificates.

You can also use the General tab to Enable, Disable specific purposes or uses for the certificate.

Note

You can only add purposes that are permitted under the guidelines and restrictions imposed when the certificate was first issued.


Properties Cross-Certificates Tab

Cross-certificates are used to establish trust between separate certification hierarchies, such as in separate networks or portions of a network. In these cases, cross-certificates are typically configured to:

  • Define the namespaces for which certificates issued in one certification hierarchy can be used and accepted in the second hierarchy.

  • Specify the acceptable uses of certificates issued by a cross-certified CA.

  • Define the issuance practices that must be followed for a certificate issued by the cross-certified CA in order for them to be considered valid in the other hierarchy

  • Create a managed trust between separate certification hierarchies.

The Cross-Certificates tab can be used to add Cross-certificate download locations and to increase or decrease the interval between downloads of cross-certificates.

When cross-certificates are used, the information contained on the Cross-certificates tab describes which of these types of restrictions, if any, have been applied.

Cross certificates can be used in both intranet and extranet environments.


View the Certificates in a PKCS #7 file

If multiple certificates are exported and saved as PKCS #7 files, or if some time has passed since the file was created, it may not be obvious what certificates a PKCS #7 file contains. The following procedure allows you to inspect the certificates contained in a PKCS #7 file.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To view the certificates in a PKCS #7 file

  1. Open Windows Explorer.

  2. Locate the PKCS #7 file in which you want to view the certificates.

  3. In the details pane, right-click the PKCS #7 file and then click Open. Certificates.

  4. In the console tree, double-click the folder containing the PKCS #7 file, and then click Certificates. The certificates contained in the PKCS #7 file are displayed in the details pane.

Additional considerations

  • A PKCS #7 file typically has a .p7b file name extension, but this is not always the case. As with any other data file, the creator of the file has control over the name and whether or not the .p7b extension is used.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.


Display Archived Certificates

Archived certificates are certificates that have expired or have been renewed. In many cases, it is good practice to retain archived certificates instead of deleting them. For example, you would need to keep an archived certificate to verify digital signatures on old documents signed using the key on the now-expired or renewed certificate.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To display archived certificates

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Right-click the appropriate certificates container, click View, and then click Options.

  3. Under Show the following, select the Archived certificates check box, and then click OK.

  4. Click one of the certificate stores. In the right-hand column, Archived certificates are identified with an A attribute in the Status column.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.


View Certificate Revocation List Details

Certificate revocation lists (CRLs) are used to distribute information about revoked certificates to individuals, computers, and applications attempting to verify the validity of certificates.

The Revocation List tab lists the serial numbers of certificates that have been revoked and the date they were revoked. The Revocation entry field may also provide information about the reason a certificate was revoked.

The General tab provides additional information about the CRL itself, including the CA that issued the CRL, when the CRL was issued, the date the next CRL will be issued, and the name of the CRL Distribution Point (CDP).


Modify the Properties of a Certificate

You can modify the properties of a certificate for a number of reasons:

  • Adding or modifying a friendly name to help differentiate it from other similar certificates.

  • Changing the purpose of the certificate by adding or disabling purposes.

  • Specifying cross-certificate download locations.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic..

To modify the properties of a certificate

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Do one of the following:

    • If you are in Logical Certificate Stores view mode, in the console tree under Logical Store, click Certificates.

    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

  3. In the details pane, click the certificate you want to modify.

  4. On the Action menu, click Properties.

  5. Make the desired changes:

    1. To change the friendly name of the certificate, in Friendly name, type the new name.

    2. To change the description of the certificate, in Description, type the new description.

    3. To enable all purposes for the certificate, based on the certificate type, in Certificate purposes, click Enable all purposes for this certificate.

    4. To disable all purposes for the certificate, in Certificate purposes, click Disable all purposes for this certificate.

    5. To designate specific purposes for the certificate, in Certificate purposes, click Enable only the following purposes and select the appropriate check boxes.

    6. To modify cross-certificate properties, click the Cross-Certificates tab, click Specify additional Cross-Certificate download locations, enter the URL where the cross-certificates can be obtained, and click Add URL.

    7. Click OK to accept all changes.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC .


Delete a Certificate

Certificates can become obsolete for a number of reasons, such as when they are compromised, become corrupted, or are replaced by a new certificate. However, even when a certificate is deleted, the corresponding private key is not deleted.

Important

Before deleting a certificate, be sure that you will not need it later for purposes such as reading old documents that were encrypted with the certificate's private key.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To delete a certificate

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Do one of the following:

    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

  3. In the details pane, click the certificate you want to delete. (To select multiple certificates, hold down CTRL and click each certificate.)

  4. On the Action menu, click Delete.

  5. Click Yes if you are sure you want to permanently delete the certificate.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • In some instances, there is not a Certificates folder in the console tree. In that case, navigate in the console tree until the certificate you want appears in the details pane, and then continue with the procedure.

  • You might want to back up the certificate by exporting it before you delete it. For the procedure to export a certificate, see Back Up Certificates.


Find Certificates

From the certificates that appear in the Certificates snap-in, it may not always be an obvious task to find the ones you want. The Find Certificates dialog box allows you to locate certificates based on a number of parameters that can be as broad or narrow as necessary to complete your task.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic..

To find a certificate

  1. Select the top node of the Certificates container for a user, computer, or service.

  2. On the Action menu, select Find Certificates.

  3. Fill in the requested information. For example, use:

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.


Back Up Certificates

Certificates are important credentials. Their loss or corruption can cause serious harm. Such harm can come from delays in authenticating your identity, blocking authentication, or making it impossible to retrieve encrypted data. You can back up certificates to protect them from loss or corruption, or to move them to a different computer.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To back up a certificate

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Do one of the following:

    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

  3. In the details pane, click the certificate you want to export.

  4. On the Action menu, point to All Tasks, and then click Export.

  5. In the Certificate Export Wizard, click No, do not export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)

  6. Provide the following information in the Certificate Export Wizard by selecting the file format you want to use to store the exported certificate: a DER-encoded binary X.509 (.CER), a Base64-encoded X.509 (CER), or a PKCS #7 Certificates (.P7B) file.

    • If you are exporting the certificate to a PKCS #7 file, you also have the option to include all certificates in the certification path.

  7. If required, In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next.

  8. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key, click Next, and then click Finish.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • After the Certificate Export Wizard is finished, the certificate will remain in the certificate store in addition to being in the new file. If you want to remove the certificate from the certificate store, you must delete it.

Additional references

Back Up a Certificate With Its Private Key.


Back Up a Certificate With Its Private Key

Certificates are important credentials. Their loss or corruption can cause serious harm. Such harm can come from delays in authenticating your identity to an inability to retrieve encrypted data. You can back up certificates to protect them from loss or corruption, or to move them to a different computer.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To export a certificate with the private key

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Do one of the following:

    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

    • If you are in Certificate purpose view mode, in the console tree, click Purpose.

  3. In the details pane, click the certificate you want to export.

  4. On the Action menu, point to All Tasks, and then click Export.

  5. In the Certificate Export Wizard, click Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)

  6. Under Export File Format, select one of the available certificate file-format options. Also, do one or all of the following, if available, and then click Next.

    • To include all certificates in the certification path, select the Include all certificates in the certification path if possible check box.

    • To include all extended properties of the certificate, select Export all extended properties.

    • To delete the private key if the export is successful, select the Delete the private key if the export is successful check box.

  7. If required, In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next.

  8. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key, click Next, and then click Finish.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • Strong protection (also known as iteration count) is enabled by default in the Certificate Export Wizard when you export a certificate with its associated private key.

  • Strong protection is not compatible with older applications.

  • After the Certificate Export Wizard is finished, the certificate will remain in the certificate store in addition to being in the newly-created file. If you want to remove the certificate from the certificate store, you will need to delete it.


Move Certificates

Many applications look for a certificate in only one certificate store. If a certificate is not in the certificate store that you need, you can move it from one store to another.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To move a certificate

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Under the logical store where the certificate is stored, click Certificates.

  3. In the details pane, click the certificate you are moving. (To select more than one certificate, hold down CTRL and click each certificate.)

  4. On the Action menu, click Cut.

  5. Click the logical certificate store where you want to move the certificate.

    Where?

    • Certificates - Current User/Logical store Name

  6. On the Action menu, click Paste.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • In Certificates, you can only move an object within certificate stores. For example, you cannot move an object to a folder in Windows Explorer. To move a certificate to or from a folder on the file system or a removable storage device, see Import a Certificate, Export a Certificate, and Export a Certificate with the Private Key.


Import a Certificate

You should only import certificates obtained from trusted sources. Importing an unreliable certificate could compromise the security of any system component that uses the imported certificate.

You can import a certificate into any logical or physical store. In most cases, you will import certificates into the Personal store or the Trusted Root Certification Authorities store, depending on whether the certificate is intended for you or if it is a root CA certificate.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To import a certificate

  1. Open the Certificates snap-in for a user, computer, or service.

  2. In the console tree, click the logical store where you want to import the certificate.

  3. On the Action menu, point to All Tasks and then click Import to start the Certificate Import Wizard.

  4. Type the file name containing the certificate to be imported. (You can also click Browse and navigate to the file.)

  5. If it is a PKCS #12 file, do the following:

    • Type the password used to encrypt the private key.

    • (Optional) If you want to be able to use strong private key protection, select the Enable strong private key protection check box.

    • (Optional) If you want to back up or transport your keys at a later time, select the Mark key as exportable check box.

  6. Do one of the following:

    • If the certificate should be automatically placed in a certificate store based on the type of certificate, click Automatically select the certificate store based on the type of certificate.

    • If you want to specify where the certificate is stored, select Place all certificates in the following store, click Browse, and choose the certificate store to use.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • Enabling strong private key protection will ensure that you are prompted for a password every time the private key is used. This is useful if you want to make sure that the private key is not used without your knowledge.

  • The file from which you import certificates will remain intact after you have completed importing the certificates. You can use Windows Explorer to delete the file if it is no longer needed.


Export a Certificate

You can export a certificate in order to import a copy on a different computer or device or to store a copy in a secure location.

If you are exporting certificates to be imported onto a computer running Windows®,

PKCS #7 format is the preferred export format. This format preserves the chain of certification authorities, or the certification path, of any certificate that includes countersignatures associated with signatures.

If you are exporting certificates for import onto a computer running another operating system, it is possible that the PKCS #7 format is supported. If it is not supported, the DER Encoded Binary format or the Base64 Encoded format is provided for interoperability.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To export a certificate

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Do one of the following:

    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

    • If you are in Certificate Purpose view mode, in the console tree, click Purpose.

  3. In the details pane, click the certificate you want to export.

  4. On the Action menu, point to All Tasks, and then click Export.

  5. In the Certificate Export Wizard, click No, do not export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)

  6. Provide the following information in the Certificate Export Wizard:

    • Click the file format you want to use to store the exported certificate: a DER-encoded file, a Base64-encoded file, or a PKCS #7 file.

    • If you are exporting the certificate to a PKCS #7 file, you also have the option to include all certificates in the certification path.

  7. If required, In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next.

  8. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key. Click Next, and then click Finish.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.

  • After the Certificate Export Wizard is finished, the certificate will remain in the certificate store in addition to being in the new file. If you want to remove the certificate from the certificate store, you must delete it.


Export a Certificate with the Private Key

In some cases you may want to export a certificate with its private key for safe keeping on removable media, or for use on a different computer. There are some restrictions to this procedure:

  • If a certificate was issued from a Windows Server 2003 certification authority, the private key for that certificate is only exportable if the certificate request was made via the Advanced Certificate Request certification authority Web page with the Mark keys as exportable check box selected, or if the certificate is for EFS (Encrypting File System) or EFS recovery.

  • Strong protection (also known as iteration count) is enabled by default in the Certificate Export Wizard when you export a certificate with its associated private key.

  • Strong protection is not compatible with older programs, so you need to clear the Enable strong protection option if you are going to use the private key with any browser earlier than Microsoft Internet Explorer 5.

Users or local Administrators are the minimum group memberships required to complete this procedure. Review the details in "Additional considerations" in this topic.

To export a certificate with the private key

  1. Open the Certificates snap-in for a user, computer, or service.

  2. Do one of the following:

    • If you are in Logical Certificate Stores view mode, in the console tree, click Certificates.

    • If you are in Certificate purpose view mode, in the console tree, click Purpose.

  3. In the details pane, click the certificate you want to export.

  4. On the Action menu, point to All Tasks, and then click Export.

  5. In the Certificate Export Wizard, click Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)

  6. Under Export File Format, do one or all of the following, and then click Next.

    • To include all certificates in the certification path, select the Include all certificates in the certification path if possible check box.

    • To enable strong protection, select the Enable strong protection (requires IE 5.0, NT 4.0 SP4 or above) check box.

    • To delete the private key if the export is successful, select the Delete the private key if the export is successful check box.

  7. In Password, type a password to encrypt the private key you are exporting. In Confirm password, type the same password again, and then click Next.

  8. In File name, type a file name and path for the PKCS #12 file that will store the exported certificate and private key. Click Next, and then click Finish.

After the Certificate Export Wizard is finished, the certificate will remain in the certificate store in addition to being in the newly-created file. If you want to remove the certificate from the certificate store, you will need to delete it.

Additional considerations

  • User certificates can be managed by the user or by an administrator. Certificates issued to a computer or service can only be managed by an administrator or user who has been given the appropriate permissions.

  • To open the Certificates snap-in, see Add the Certificates Snap-in to an MMC.


Automate Certificate Management

Managing certificates one at a time can be a laborious, if not impossible, task. Many organizations will manage certificates using Group Policy settings configured on a server and applied to clients in a domain, group, or organizational unit. The following options can be viewed on a client, although they are typically configured on a server.

Credential Roaming

Certificate Path Validation


Credential Roaming

Credential roaming allows organizations to store certificates and private keys in Active Directory apart from application state or configuration information.

How credential roaming works

Credential roaming uses existing logon and auto-enrollment mechanisms and must be configured on a server running this version of Windows. These mechanisms make it possible to safely and securely download certificates and keys to a local computer whenever a user logs on and, if desired, remove them when the user logs off. In addition, the integrity of these credentials is maintained under any conditions, such as when certificates are updated and when users log on to more than one computer at a time.

The following steps describe how digital credential roaming works.

  1. A user logs on to a client computer that is connected to an Active Directory domain.

  2. As part of the logon process, credential roaming Group Policy is applied to the user’s computer.

  3. If this is the first time that credential roaming is being used, the certificates in the user's store on the client computer are copied to Active Directory.

  4. If the user already has certificates in Active Directory, the certificates in the user’s certificate store on the client computer are compared to the certificates stored for the user in Active Directory.

  5. If the certificates in the user's certificate store are current, then no further action is taken. However, if more recent certificates for the user are stored in Active Directory, then these credentials are copied to the client computer. If more recent certificates for the user are stored on the client computer, then these credentials are copied to Active Directory.

  6. If additional certificates are needed on the client, outstanding certificate auto-enrollment requests are processed.

    Note

    Newly issued certificates are stored in the certificate store on the client and replicated to Active Directory.

  7. Later, when the user logs on to another client computer connected to the domain, the same Group Policy is applied, and credentials are once again replicated from Active Directory. Credential roaming synchronizes and resolves any conflicts between certificates and private keys from any number of client computers that the user logs on to, as well as in Active Directory.

    Important

    In multi-domain environments and domains with multiple domain controllers, credentials may not be immediately available when a user logs on to the network using one domain controller shortly after being issued a certificate on a computer that validates the user's identity against a different domain controller. The credentials will only become available after replication has been completed between the two domains or domain controllers.

  8. On subsequent logons, the certificate in the local certificate and key stores are compared to the certificates and keys in Active Directory:

    • If the certificates and keys are current, no further action is taken.

    • If certificates and keys are not synchronized, they are synched.

    • If additional certificates or keys are needed, or if certificates and keys need to be renewed, auto-enrollment is used to contact the certification authority (CA), issuance and renewal take place, and the updated certificates and keys are replicated to Active Directory.

  9. When the user logs on to the other computer, the updated certificates and keys are replicated to the certificate and key stores on this computer as well.

  10. When the user’s certificate expires, the old certificate is automatically archived in the client's profile and in Active Directory.

Credential roaming is triggered any time a private key or certificate in the user’s local certificate store changes, whenever the user locks or unlocks the computer, and whenever Group Policy is refreshed.

All certificate-related communication between components on the local computer and between the local computer and Active Directory is signed and encrypted.


Certificate Path Validation

As certificate use for secure communication and data protection is increasing, administrators can use certificate trust policy to enhance their control of certificate use and public key infrastructure performance by using certificate path validation options.

Certificate Path Validation settings in Group Policy allow administrators to:

  • Manage Trusted Root Certificates. This controls which root CA certificates and peer trust certificates in the user certificate and root certificate stores can be trusted.

  • Manage Trusted Publishers. This controls which code signing (Authenticode®) certificates can be accepted for use in the organization and blocks certificates that are not trusted according to policy

  • Manage Network Retrieval and Path Validation. This can compensate for situations where downloads of a certificate revocation list (CRL) fail because the CRL is too large, and network conditions are less than optimal.

  • Manage Revocation Checking Policy. Coordinates use of certificate revocation lists and online responders during revocation checking. This option also allows an administrator to extend the lifetime of responses received from an online responder or CRL.


Manage Trusted Root Certificates

Because of the growing variety of certificates in use today and the growing number of certificate issues, some organizations may want to manage certificate trust and prevent users in the domain from configuring their own set of trusted root certificates. In addition, some organizations may want to identify and distribute specific trusted root certificates to enable business scenarios where additional trust relationships are needed.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To manage trusted root certificates for a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Local Group Policy Object Editor, click Add, select the computer whose local Group Policy object (GPO) you want to edit, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. In the console tree, go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  6. Double-click Certificate Path Validation Settings, and then click the Stores tab.

  7. Select the Define these policy settings check box.

  8. Under Per user certificate stores, clear the Allow user trusted root CAs to be used to validate certificates and Allow users to trust peer trust certificates check boxes.

  9. Under Root certificate stores, select the root CAs that the client computers can trust, and then click OK to apply the new settings.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To manage trusted root certificates for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the Group Policy Management Console (GPMC) was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy GPO that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Double-click Certificate Path Validation Settings, and then click the Stores tab.

  8. Select the Define these policy settings check box.

  9. Under Per user certificate stores, clear the Allow user trusted root CAs to be used to validate certificates and Allow users to trust peer trust certificates option in the Per User Certificate Stores check boxes.

  10. Under Root certificate stores, select the root CAs that the client computers can trust, and then click OK to apply the new settings.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To add certificates to the Trusted Root Certification Authorities store for a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Certificates, and then click Add.

  4. Under This snap-in will always manage certificates for, click Computer account, and then click Next.

  5. Click Local computer, and click Finish.

  6. If you have no more snap-ins to add to the console, click OK.

  7. In the console tree, double-click Certificates.

  8. Right-click the Trusted Root Certification Authorities store.

  9. Click Import to import the certificates and follow the steps in the Certificate Import Wizard.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To add certificates to the Trusted Root Certification Authorities store for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the GPMC was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy GPO that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Right-click the Trusted Root Certification Authorities store.

  8. Click Import and follow the steps in the Certificate Import Wizard to import the certificates.

Additional considerations

  • Group Policy options can only be changed by an administrator.


Manage Trusted Publishers

Software signing is being used by a growing number of software publishers and application developers to verify that their applications come from a trusted source. However, many users do not understand or pay little attention to the signing certificates associated with applications that they install.

The policy options in the Trusted Publishers tab of the Certificate Path Validation policy allows administrators to control which certificates can be accepted as coming from a trusted publisher.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To configure the Trusted Publishers policy for a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Local Group Policy Object Editor, click Add, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. In the console tree, go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  6. Double-click Certificate Path Validation Settings, and then click the Trusted Publishers tab.

  7. Select the Define these policy settings check box, implement the changes you want, and then click OK to apply the new settings.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To configure the Trusted Publishers policy for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the Group Policy Management Console (GPMC) was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy Group Policy object (GPO) that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Double-click Certificate Path Validation Settings, and then click the Trusted Publishers tab.

  8. Select the Define these policy settings check box, implement the changes you want, and then click OK to apply the new settings.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To allow only administrators to manage certificates used for code signing for a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Local Group Policy Object Editor, click Add, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. In the console tree, go to Default Domain Policy or Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  6. Double-click Certificate Path Validation Settings, and then click the Trusted Publishers tab.

  7. Select the Define these policy settings check box.

  8. Under Trusted publisher management, click Allow only all administrators to manage Trusted Publishers, and then click OK to apply the new settings.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To allow only administrators to manage certificates used for code signing for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the GPMC was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy GPO that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Double-click Certificate Path Validation Settings, and then click the Trusted Publishers tab.

  8. Select the Define these policy settings check box, implement the changes you want, and then click OK to apply the new settings.

Additional considerations

  • Group Policy options can only be changed by an administrator.


Manage Network Retrieval and Path Validation

To be effective, certificate-related data such as trusted root certificates, cross- certificates, and certificate revocation lists must be updated in a timely manner. Network retrieval and path validation settings allow administrators to:

  • Automatically update certificates in the Microsoft Root certificate Program

  • Configure retrieval timeout values for certificate revocation lists (CRLs) and path validation (larger default values may be useful if network conditions are not optimal)

  • Enable issuer certificate retrieval during path validation

  • Define how frequently cross-certificates are downloaded.

Managing CRL retrieval

Obtaining timely certificate-revocation data is an important element in secure certificate use. However, problems can arise if validation checking and retrieval of certificate revocation data and cross-certificates time out because more data is being transferred than originally anticipated.

Network retrieval options in public key Group Policy allow administrators to manage network retrieval timeout values.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To increase the retrieval timeout option for large CRLs for a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Local Group Policy Object Editor, click Add, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. In the console tree, go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  6. Double-click Certificate Path Validation Settings, and then click the Network Retrieval tab.

  7. Select the Define these policy settings check box.

  8. Under Default retrieval timeout settings, enter a timeout value in the Default URL retrieval timeout (in seconds) box, and then click OK to apply the new settings.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To increase the retrieval timeout option for large CRLs for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the Group Policy Management Console (GPMC) was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy Group Policy object (GPO) that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Double-click Certificate Path Validation Settings, and then click the Network Retrieval tab.

  8. Select the Define these policy settings check box.

  9. Under Default retrieval timeout settings, enter a timeout value in the Default URL retrieval timeout (in seconds) box, and then click OK to apply the new settings.

Additional considerations

  • Group Policy options can only be changed by an administrator.


Manage Revocation Checking Policy

Revocation of a certificate invalidates a certificate as a trusted security credential prior to the natural expiration of its validity period. A public key infrastructure (PKI) depends on distributed verification of credentials in which there is no need for direct communication with the central trusted entity that vouches for the credentials.

To effectively support certificate revocation, the client must determine whether the certificate is valid or has been revoked. To support a variety of scenarios, Certificate Services supports industry-standard methods of certificate revocation.

These include publication of certificate revocation lists (CRLs) and delta CRLs in several locations for clients to access, including the Active Directory directory service, Web servers, and network file shares. In Windows, revocation data can also be made available in a variety of settings through online certificate status protocol (OCSP) responses.

Note

CRLs are published to specified network locations on a periodic basis where they can be downloaded by requesting clients. OCSP responses are digitally-signed responses indicating whether an individual certificate has been revoked or suspended, of it its status is unknown. OCSP responders get their data from published CRLs, or they can be updated directly from the certificate status database of a certification authority (CA).

In addition, public key Group Policy allows administrators to enhance the use of CRLs and online responders, particularly in situations where extremely large CRLs or network conditions detract from performance.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To configure revocation settings on a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Local Group Policy Object Editor, click Add, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. In the console tree, go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  6. Double-click Certificate Path Validation Settings, and then click the Revocation tab.

  7. Select the Define these policy settings check box, select the policy options you want, and then click OK to apply the new settings.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To configure revocation settings for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the Group Policy Management Console (GPMC) was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy Group Policy object (GPO) that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Double-click Certificate Path Validation Settings, and then click the Revocation tab.

  8. Select the Define these policy settings check box, select the policy options you want, and then click OK to apply the new settings.

Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To extend the validity period for CRL and OCSP responses for a local computer

  1. Click Start, click Start Search, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Local Group Policy Object Editor, click Add, and then click Finish.

  4. If you have no more snap-ins to add to the console, click OK.

  5. In the console tree, go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  6. Double-click Certificate Path Validation Settings, and then click the Revocation tab.

  7. Select the Define these policy settings check box, and then select the Allow CRL and OCSP responses to be valid longer than their lifetime check box.

  8. In the Default time the validity period can be extended box, and enter a value of time (in hours), and then click OK to apply the new settings.

Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.

To extend the validity period for CRL and OCSP responses for a domain

  1. Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.

  2. After the Installation Results page shows that the installation of the GPMC was successful, click Close.

  3. Click Start, point to Administrative Tools, and then click Group Policy Management.

  4. In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy GPO that you want to edit.

  5. Right-click the Default Domain Policy GPO, and then click Edit.

  6. In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.

  7. Double-click Certificate Path Validation Settings, and then click the Revocation tab.

  8. Select the Define these policy settings check box, and then select the Allow CRL and OCSP responses to be valid longer than their lifetime check box.

  9. In the Default time the validity period can be extended box, enter a value of time (in hours), and then click OK to apply the new settings.

Additional considerations

  • You must be an administrator to modify Group Policy settings.


Troubleshoot Certificate-related Problems

This section lists a few common issues you may encounter when using the Certificates snap-in or working with certificates.

What problem are you having?

  • I cannot enroll for a new certificate using the Certificate Request Wizard.

  • I get a message indicating that I need to enroll for a new certificate, but the enrollment process fails.

  • I cannot enroll for a new certificate over the Web.

  • I am no longer able to use my certificate

I cannot enroll for a new certificate using the Certificate Request Wizard.

Cause: The type of certificate you are requesting is not available.

Solution: Contact your administrator.

I get a message indicating that I need to enroll for a new certificate, but the enrollment process fails.

Cause: In order for clients to receive certificates, they need to be able to contact the certification authority (CA) that will process the request.

Solution: If a CA is intended to be offline, the certificate request must be processed manually by copying it to removable media and physically carrying it to the CA for processing. Otherwise, wait until the CA is once again online and try again.

Cause: If the CA is online but enrollment still fails, it may be the autoenrollment permissions have not been configured properly.

Solution: An administrator must modify the access control list on the certificate template to grant Read, Enroll, and Autoenroll permissions for the intended recipients of the certificate.

I cannot enroll for a new certificate over the Web.

Cause: The certification authority that you are attempting to contact needs to be updated to process certificate requests from this version of Windows clients.

Solution: Contact your administrator

Cause: Enhanced Internet Explorer security prevents you from accessing the Web site associated with the CA.

Solution: Add the Web address of the CA to Trusted sites in Internet Explorer. You can locate the Security tab by clicking Internet Options on the Tools menu.

I am no longer able to use my certificate

Cause: The certificate has expired or is not valid for the intended purpose.

Solution: View the certificate to determine its expiration date. If it has expired, use the Certificate Renewal Wizard to renew the certificate. If it has not expired, verify that the certificate is valid for your desired purpose. If it is not, request a new certificate for the desired purpose.


Resources for Certificates

For more information about certificates, see the following resources on the Microsoft Web site:

  • Certificates Technical Reference (http://go.microsoft.com/fwlink/?LinkId=64035)

  • Certificate Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=64036)

  • Certificate Autoenrollment in Windows Server 2003 (http://go.microsoft.com/fwlink/?LinkId=64037)

  • Windows Server 2003 Advanced Certificate Enrollment and Management (http://go.microsoft.com/fwlink/?LinkId=64038)


Encrypting File System (EFS)

The Encrypting File System (EFS) is a core file encryption technology used to store encrypted files on NTFS file system volumes. Encrypted files cannot be used unless the user has access to the keys required to decrypt the information.

Encryption is transparent to the user that encrypted the file. This means that you do not have to manually decrypt the encrypted file before you can use it. You can open and change the file as you normally do. Once you encrypt a file or folder, you work with the encrypted file or folder just as you do with any other file or folder.

Using EFS is similar to using permissions on files and folders. Both methods can be used to restrict access to data. However, an intruder who gains unauthorized physical access to your encrypted files or folders will be prevented from reading them. If the intruder tries to open or copy your encrypted file or folder, he or she receives an access denied message. Permissions on files and folders do not protect against unauthorized physical attacks.

You encrypt or decrypt a folder or file by setting the encryption property for folders and files just as you set any other attribute such as read-only, compressed, or hidden. If you encrypt a folder, all files and subfolders created in the encrypted folder are automatically encrypted. It is recommended that you encrypt at the folder level.

You can also encrypt or decrypt a file or folder by using the Cipher command.

When you work with encrypted files and folders, keep in mind the following information:

  • Only files and folders on NTFS volumes can be encrypted. However, you can use Web distributed authoring and versioning (WebDAV), which also works with NTFS, to transfer files in encrypted form.

  • Files or folders that are compressed cannot also be encrypted. If the user marks a file or folder for encryption, that file or folder will be uncompressed.

  • Encrypted files are decrypted if you copy or move the file to a volume that is not an NTFS volume.

  • Moving unencrypted files into an encrypted folder will automatically cause those files to be encrypted in the new folder. However, the reverse operation will not automatically decrypt files. Files must be explicitly decrypted.

  • Files marked with the System attribute cannot be encrypted, nor can files in the system root directory structure.

  • Encrypting a folder or file does not protect against the deletion or listing of files or directories. Anyone with the appropriate permissions can delete or list encrypted folders or files. For this reason, using EFS in combination with NTFS permissions is recommended.

  • You can encrypt or decrypt files and folders located on a remote computer that has been enabled for remote encryption, but, in this version of Windows, the data that is transmitted over the network by this process is not encrypted. Other protocols, such as Secure Socket Layer/Transport Layer Security (SSL/TLS) or Internet Protocol security (IPsec) must be used to encrypt data while it is in transmission over the network. (You can also use WebDAV, as described in the first bullet, to transmit the file in encrypted form.)

EFS Policy Settings

You can use Group Policy to configure a number of EFS settings.

Allow or Disallow EFS

You can choose to allow or disallow the use of EFS altogether. If you do not configure any policy settings for EFS, it is allowed.

EFS Options

If you choose to allow EFS, you can also select a number of options, such as whether to automatically encrypt a user's Documents folder, to require a smart card for use with EFS, to cache keys created based on a smart card, to enable the encryption of the Windows page file, or to notify users to make backup copies of their encryption keys.

EFS Certificates

EFS encryption is based on the key pairs associated with certificates. In most managed environments, certificates are issued by a certification authority (CA) running in the domain. Users can automatically be issued a certificate by the CA without manual intervention. The EFS settings include a drop-down list of certificate templates available in the domain so that you can specify which certificate template to use for autoenrollment.

Note

The list includes all certificate templates present in the domain. An administrator must correctly configure the CA so that the certificates can be issued. Some displayed certificates might not be accessible.

In cases where a certificate cannot be issued by a CA, EFS can use a self-signed certificate created on the local computer. You can choose to disable this functionality and specify a default key length.


Certificate and key caching in the Encrypting File System

To optimize performance, the Encrypting File System (EFS) will cache both certificates and keys used in the encryption or decryption process. You can control when these cached items are removed from memory.

Certificate Caching

Once EFS uses a certificate, it is cached on the local computer. This eliminates the need for looking up users in Active Directory every time a new user is added to an encrypted file.

Certificates that are part of a certificate chain, and self-signed certificates, can be used and cached. When a user certificate that is part of a certificate chain is added to an encrypted file, the certificate will be cached in the current user's "Other People" certificate store. Certificates for other people that are self-signed, such as those generated automatically by EFS when no certification authority is available, are cached in the "Trusted People" certificate store of the current user.

When a certificate is added to the "Trusted People" store, the user is warned that the certificate will be explicitly trusted and asks the user to verify the action. Once a certificate is added to the Trusted People store, no certificate status checking will be performed with the exception of time validity.

Note

Users that hold a private key on the local computer are also added to the "Trusted People" store, in addition to the "Other People" store. This enhances the performance of local encryption on the computer.

Key Caching

Windows is tuned to optimize the caching of user keys on a server when the server is being used for remote server encryption. By default, the server will cache up to 15 user key handles in memory to increase encryption performance on the server. However, the default can be changed by an administrator by editing the following registry value:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS\UserCacheSize DWORD

The acceptable values are between 5 and 30 for this registry value.

Note

Private keys are not stored in cached memory, but only as a handle to the CryptoAPI key container.

Changing Key Caching Properties

You can change the performance of key caching by selecting options on the Cache tab of the Encrypting File System Properties page in Group Policy or the local system policy.

For example, you can configure an automatic timeout value, and specify that the cache should be cleared when the user locks the workstation. The cache is also cleared when the user logs off or the computer is restarted.


View Security Catalog Details

A security catalog is a signed container which holds hashes of other files and sometimes additional information such as the operating system version supported.

The Security Catalog tab lists the files contained within the catalog and significant values associated with each file.

The General tab contains information about the security catalog itself, including the version number, effective date, algorithms, and subject usage.


View Certificate Trust List Details

A certificate trust list (CTL) enables you to control trust of the purpose and of the validity period of certificates that are issued by external certification authorities (CA)

Typically, a certification authority can issue certificates for a wide variety of purposes, such as secure e-mail or client authentication. But there might be situations in which you want to limit the trust of certificates that are issued by a particular certification authority, especially if the CA is outside your organization. In these situations, creating a certificate trust list and using it through Group Policy can be useful.

The Trust List tab lists the certificates contained within the CTL and significant values associated with each certificate.

The General tab contains information about the CTL itself, including the version number, effective date, algorithms, and subject usage.